ConnectWise Cloud Backup application abused in cross-tenant token sweep
2026-10-20T08:51:30Z•9114c7103760f697d9014b19fc8664da49c19bc9ede8f706616ca2640510acf4
AI governanceActive DirectoryEDR tamperingMicrosoft Entra IDMicrosoft GraphOAuth application abuseServiceNow enumerationcloud backupconsent abusecross-tenant accessdefense evasionidentity intrusiontoken theft
What happened
Sophos reports an identity-focused intrusion in which attackers abused the ConnectWise Cloud Backup Entra application identity to obtain Microsoft Graph tokens across consenting customer tenants. Related reporting describes Graph reconnaissance, ServiceNow user enumeration, Active Directory compromise techniques, and defenses against EDR-killing tools. The feed also includes product and governance announcements. No specific CVEs are identified.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- 9114c7103760f697d9014b19fc8664da49c19bc9ede8f706616ca2640510acf4
- Enrichment time
- 2026-10-20T08:51:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.